Extracted

• • Target
    E2C31090339C37FAF04CE2489EA35E9E22844B5AEF1A0.exe
  • Size 3.2MB
  • SHA256 e2c31090339c37faf04ce2489ea35e9e22844b5aef1a05022bbff6c6d8a13b68
  • MD5 e8afa6968df077d832e6f9a8b6d7cb77
  • SHA1 7b3600e502a32bd4f1904eae88e94ba736cf9b38
  • SHA512 05babf51d9593324df37e689dbe667f8bb905d63d476617c12a5f410c710fb85cf85912349f62cfe18fbe823f3d4184ff882da0dbab024b6f024fc4b47db0aa4
  • SSDEEP 98304:V0qXpy05Q0N1rsYSZ6BoXh1kkypSH3Oh5Bemg:Vt405QYtsTEB08T8HehLv
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  njrathackedevasionspywarestealertrojanupx

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2